asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trigferFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trIggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triwgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="4" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz))"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang triggerconsole.log('recursive script at step 0'i;
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
<!-- Google Analytics -->Active <object> insertion
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuxz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerNuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="t�iggerFuzz()" onblur="triggerFuzz()" onerror="triggerFu:z()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz))" onblur="triggerFuzz(!" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
<!-- Google Analytics -->Active <object> insertion<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
window.mutationCounter++
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="u" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
Active <form> insertionhang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
potential uaf trigger
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
potential uaf trigger
potential uaf trigger
i might go away soon...
this script might make the browser unresponsive.
potential hang trigger
potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential hang trigger
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
Active <object> insertionhang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
<!-- Google Analytics -->i might go away soon...
asan crash demo (uaf attempt)<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
console.log('recursive script at ster 0');
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step$0');</coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trig�erFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triGgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="81b8d540-abb5-4dca-98e3-8c72682a2245" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggdrFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><script data-entangled="b5e71581-1f91-47f0-838c-d9e87c4ce841" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="ae0534a6-7f61-48d3-8f94-1f4000a7b114" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Google Analytics -->
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzr()" onblur="triggerFuzz()" onerror="triggeruzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuz{()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill click="alert('Interactive mutation at step 3');" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->console.log('recursive script at step 0');
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tricgerFuzz()" onerror="trigge2Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trhggerFuzz()" onerror="triggerfuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="43453900-ffb6-4e01-9953-8335e4a4e15b" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="44c8da70-e968-43d7-a756-7b8fa4076475" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="d2ac1608-6bba-45a7-9b24-ca7a639ff26a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="b2491cff-aa81-4276-b3e9-ffb83507b784" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
<!-- Google Analytics -->Active <object> insertion
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="�riggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf838rf-9a04-4320-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="tbiggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script click="alert('Interactive mutation at step 3');" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="driggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="trhggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fe-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 2');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trigwerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f7dbb85d-bfe4-4e86-8861-489c6ffd7c02" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="vriggerFuzz()" onblur="tri�gerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
<!-- Google Analytics -->Active <object> insertion<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-entangled="337f19c1-b6ea-45e2-a178-690c47c29be6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFujz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzj()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFyzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFyzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz(9"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFurz()" onblur="triggerFuzz()" onerror="triggerNuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuz:()" onblur="triggerFuzz()" onerror="triggerFu{z()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-entangled="dd3f13f8-03ed-4c05-86bc-6b3756bbde32" data-uncovered-attr="fuzz" onabort="triggerFuzz(9" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onabort="triggerVuzz()" onblur="triggerFuzz()" onerror="triggerFqzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="f9ba1238-f972-403c-88e6-0ef69d6bd1a6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigGerFuzz()" onerror="triggerFuzzh)">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="vriggerFuzz()" onerror="trigg�rFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="814ebda4-2ff3-4ca5-96c7-c28ae1204e59" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger<!-- Appears broken in IE -->
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerBuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFezz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="d10fd0dc-a1a2-4857-8e8b-2d9f6c4a9d31" data-uncovered-attr="fuzz" onblur="triggerFezz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="7b6ff7c3-74d9-�4b2-arf8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferNuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFu~z()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuz~()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggeRFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz(!"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigggrGuzz()" onerror="trkggerFu:z()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggdrFuzz()" onblur="triggerFuzz()" onerror="triggerFuxz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>
Active <form> insertionhang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="15da62d4-7f3a-4f26-9ea8-702abe90788d" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)
potential uaf trigger
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="|riggerFuzz()" onerror="trig�erFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="a81b6fe3-1d34-4959-9f84-e03895a626f3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f145feb6-4af0-43d5-ac4d-902ce60409b2" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>potential hang trigger
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzj()" onblur="triggerFuzz()" onerror="triggerFu{z()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="13a82d83-45c0-4972-96ec-01ea815feaed" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="8d4ac7e2-f188-4697-a11b-8b9922511659" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerF5zz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
i might go away soon...
potential hang trigger
potential uaf trigger
Active <object> insertionthis script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="uriggerFuzz()" onerror="tziggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tr�ggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz)">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="7265ac58-1c77-447b-8c15-aef6e9cd970d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onabort="trigcerFuzz()" onblur="triggerFuzz()" onerror="trigferFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill click="function handleEvent() {
try {
try {
const res = window.mutationCounter++;
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-entangled="4baa82cc-e85e-4b43-b95c-e00296d565ca" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerfuzz()" onerror="driggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triwgerFuzz()" onerror="tviggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="priggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.body.appendChild(document.createElement('div'))
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triGgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="81b8d540-abb5-4dca-98e3-8c72682a2245" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuZz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><script data-entangled="b5e71581-1f91-47f0-838c-d9e87c4ce841" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="ae0534a6-7f61-48d3-8f94-1f4000a7b114" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Google Analytics -->
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuz{()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFtzz()" onerror="�riggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz*)" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onabort="triggerDuzz()" onblur="triggerFuzz()" onerror="triggerNuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tricgerFuzz()" onerror="trigge2Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="43453900-ffb6-4e01-9953-8335e4a4e15b" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="44c8da70-e968-43d7-a756-7b8fa4076475" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="d2ac1608-6bba-45a7-9b24-ca7a639ff26a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="b2491cff-aa81-4276-b3e9-ffb83507b784" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
<!-- Google Analytics -->Active <object> insertion
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onabort="triggerFuzz(-" onblur="triggerFuzz()" onerror="triggerFuzj()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triogerFuzz()" onblur="tpiggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf8382f-9a04-4320-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fe-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 2');" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trigwerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f7dbb85d-bfe4-4e86-8861-489c6ffd7c02" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggeruzz()" onerror="trigger�uzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
<!-- Google Analytics -->Active <object> insertion<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-entangled="337f19c1-b6ea-45e2-a178-690c47c29be6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerNuzz()" onblur="triggeruzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFujz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggezFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script click="alert('Interactive mutation at step 3');" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-entangled="dd3f13f8-03ed-4c05-86bc-6b3756bbde32" data-uncovered-attr="fuzz" onabort="triggerFuzz(9" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="f9ba1238-f972-403c-88e6-0ef69d6bd1a6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerGuzz()" onerror="triogerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="trigg�rFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="814ebda4-2ff3-4ca5-96c7-c28ae1204e59" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger<!-- Appears broken in IE -->
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="d10fd0dc-a1a2-4857-8e8b-2d9f6c4a9d31" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFezz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz))">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFu~z()" onblur="triggerFuzz()" onerror="triggerF}zz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigggrGuzz()" onerror="trkggerFu:z()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onabort="triggerDuzz()" onblur="trhggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>
Active <form> insertionhang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="15da62d4-7f3a-4f26-9ea8-702abe90788d" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)
potential uaf trigger
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggezFuzz()" onblur="tpiggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFtzz()" onerror="tpiggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="a81b6fe3-1d34-4959-9f84-e03895a626f3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f145feb6-4af0-43d5-ac4d-902ce60409b2" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>potential hang trigger
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="13a82d83-45c0-4972-96ec-01ea815feaed" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="8d4ac7e2�f188-4697-a11b-8b9922511659" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerNuzz()" onerror="triggerFu{z()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerF5zz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
i might go away soon...
potential hang trigger
potential uaf trigger
Active <object> insertionthis script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz)">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="7265ac58-1c77-447b-8c15-aef6e9cd970d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="alert('Interactive mutation at step 3');" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigge2Fuzz()" onerror="traggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill click="function handleEvent() {
try {
try {
const res = window.mutationCounter++;
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-entangled="4baa82cc-e85e-4b43-b95c-e00296d565ca" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
#onsole.log('recursive script at step 1');<!-- Google Analytics -->
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf8382f-9a04-43r0-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="trigferFuzz()" onblur="triggerFuzz()" onerror="triggerFujz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggerFu�z()" onblur="triggerFuzz()" onerror="triggerFurz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="driggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fe-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interac|ive mutation at step 2');" data-depth="" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="tRiggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 2');" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f7dbb85d-bfe4-4e86-8861-489c6ffd7c02" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuz:()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
<!-- Google Analytics -->Active <object> insertionasan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Google Analytics -->
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="TriggerFuzz()" onblur="tsiggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuz{()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggeruzz()" onerror="triggerFqzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggurFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFu~z()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill click="alert('Interactive mutation at step 3');" data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trIggerFuzz()" onerror="triggebFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="trigge2Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="43451900-ffb6-4e01-9953-8335e4a4e15b" data-uncovered-attr="fuzz" onabort="triggerFUzz()" onblur="triggerFuzz()" onerror="trigeerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="44c8da70-e968-43d7-a756-7b8fa4076475" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="d2ac1608-6bba-45a7-9b24-ca7a639ff26a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="b2491cff-aa81-4276-b3e9-ffb83507b784" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
<!-- Appears broken in IE --><!-- Google Analytics -->Active <object> insertion
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz )" onerror="trigge�Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggeruzz()" onblur="triggerFuzz()" onerror="trigferFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuz{()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerF�zz()" onblur="triggerFuzz()" onerror="triggerFuzz((">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="trigge2Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
this script might make the browser unresponsive.
potential hang trigger
Active <form> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="43453900-ffb6-4e01-9953-8335e4a4e15b" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="44c8da70-e968-43d7-a756-7b8fa4076475" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="d2ac1608-6bba-45a7-9b24-ca7a639ff26a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="b2491cff-aa81-4276-b3e9-ffb83507b784" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
<!-- Google Analytics -->Active <object> insertion<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz)" onerror="trig'erFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth=";" data-uncovered-attr="fuzz" onabort="triogerFuzz()" onblur="tricgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-entangled="337f19c1-b6ea-45e2-a178-690c47c29be6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFujz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="trigferFuzz()" onblur="triggerFuzz()" onerror="triegerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onabort="triggerF}zz()" onblur="triggerFuzz()" onerror="triggurFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trigoerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triegerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf8382f-9a04-4320-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
console.log('recur3ive script at step 0');
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFyzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggerFuz{()" onblur="triggerFuzz()" onerror="triggerFuxz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggeRFuzz()" onblur="triggesFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Google Analytics --><!-- Temporary fix -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Google Analytics -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="t2iggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz(i" onerror="triggerFuzz,)">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigger�uzz()" onerror="triegerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggebFuzz()" onblur="trigge2Fuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="trigoerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"></entanglement-wrapper>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-entangled="dd3f13f8-03ed-4c05-86bc-6b3756bbde32" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="f9ba1238-f972-403c-88e6-0ef69d6bd1a6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="trigGerFuzz()" onblur="trigge2Fuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerBuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-entangled="337f19c1-b6ea-45e2-a178-690c47c29be6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggepFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="t2iggerFuzz()" onblur="triggerF}zz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fe-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggevFuzz()" onblur="triggerFuzz()" onerror="triggerFUzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggezFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf8382f-9a04-4320-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerF}zz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="trigGerFuzz()" onblur="triggerFuzz()" onerror="trigg���rFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Google Analytics --><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
hang / timeout demo<coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggdrFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
potential uaf trigger
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
<!-- Temporary fix -->potential hang trigger<!-- Appears broken in IE -->
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...<!-- Appears broken in IE -->
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics --><!-- Appears broken in IE -->hang / timeout demo<coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onabort="triggerFuzx()" onblur="triggerFuzz()" onerror="triggerFuzr()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Google Analytics -->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Google Analytics -->
<!-- Temporary fix -->potential hang trigger
this script might make the browser unresponsive.
<!-- Temporary fix -->potential hang trigger<!-- Appears broken in IE -->
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzj()" onblur="triggerFuzz()" onerror="|riggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="43453900-ffb6-4e01-9953-8335e4a4e15b" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="44c8da70-e968-43d7-a756-7b8fa4076475" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1`" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzzh)"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="d2ac1608-6bba-45a7-9b24-ca7a639ff26a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="b2491cff-aa81-4276-b3e9-ffb83507b784" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><entanglement-wrapper data-entangled="a26ea412-badd-40f5-a210-ca8af1ff0e1d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = window.mutationCounter++;
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triGgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="81b8d540-abb5-4dca-98e3-8c72682a2245" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="d10fd0dc-a1a2-4857-8e8b-2d9f6c4a9d31" data-uncovered-attr="fuzz" onblur="triggerFezz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fg-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerF5zz()" onblur="triggerFuzz))" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="driggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerF}zz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="trmggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
window.mutationCounter++
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuz~()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 2');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz((" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
Active <form> insertion
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tr)ggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)
potential uaf trigger
potential uaf trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="814ebda4-2ff3-4ca5-96c7-c28ae1204e59" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="15da62d4-7f3a-4f26-9ea8-702abe90788d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerGuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigggrGuzz()" onerror="trkggerFu:z()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onabort="driggerFuzz()" onblur="triggerFuzz�)" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFu:z()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script click="alert('Interactive mutation at step 3');" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="4ed975fe-6eb3-4113-9fd2-dc0f067ce1b0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="d10fd0dc-a1a2-4857-8e8b-2d9f6c4a9d31" data-uncovered-attr="fuzz" onblur="triggerFezz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="1" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="t�iggerFuzz()" onerror="tpiggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="trigg%rFuzz()" onblur="triggerFuzz()" onerror="trigGerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
potential uaf trigger
this script might make the browser unresponsive.
<!-- Appears broken in IE -->Active <form> insertion
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
Active <form> insertionhang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>
asan crash demo (uaf attempt)
potential uaf trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="7b6ff7c3-74d9-�4b2-a2f8-e33c1d2528ff" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigferFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-entangled="2d575dba-50cd-4876-92b6-6f0028e4e2e0" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = new ArrayBuffer(1e6);
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
i might go away soon...
potential hang trigger
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><!--[if lt IE 9]> <script>alert('old IE')<![endif]--><script data-entangled="b5e71581-1f91-47f0-838c-d9e87c4ce841" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="ae0534a6-7f61-48d3-8f94-1f4000a7b114" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="13a82d83-45c0-4972-96ec-01ea815feaed" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script><script data-entangled="8d4ac7e2-f188-4697-a11b-8b9922511659" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-entangled="64ab3a6b-deff-4580-8f2e-836be9f6f10f" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="function handleEvent() {
try {
try {
const res = document.body.appendChild(document.createElement('div'));
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="t2iggerFuzz()" onblur="triggerfuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f7dbb85d-bfe4-4e86-8861-489c6ffd7c02" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>
this script might make the browser unresponsive.
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="a81b6fe3-1d34-4959-9f84-e03895a626f3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-entangled="dd3f13f8-03ed-4c05-86bc-6b3756bbde32" data-uncovered-attr="fuzz" onabort="triggerFuzz(9" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="f9ba1238-f972-403c-88e6-0ef69d6bd1a6" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
<!-- Appears broken in IE -->asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="TriggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tpiggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="f145feb6-4af0-43d5-ac4d-902ce60409b2" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onblur="tbiggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential uaf trigger
this script might make the browser unresponsive.
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="vriggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz(�" onblur="triggmrFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="driggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill><!-- Appears broken in IE -->this script might make the browser unresponsive.
potential hang trigger
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script click="alert('Interactive mutation at step 3');" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
potential uaf trigger
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="668bc4ae-a10e-45c4-b272-9e8fc5d53ab8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tviggerFuzz()" onblur="triggerFuzz((" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tr�ggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="7265ac58-1c77-447b-8c15-aef6e9cd970d" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-entangled="8b221be9-33f7-4fe2-987d-abced86cb09a" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 2');" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-entangled="6d66ac11-abb8-48e2-9cc6-511cd5b1ed26" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper><script click="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-entangled="337f19c1-b6ea-45e2-a178-690c47c29be6" data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill click="function handleEvent() {
try {
try {
const res = window.mutationCounter++;
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="%" data-entangled="4baa82cc-e85e-4b43-b95c-e00296d565ca" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
potential uaf trigger
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="1" data-uncovered-attr="fuzz" onblur="triggerFu~z()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>potential uaf trigger
potential hang trigger
this script might make the browser unresponsive.
i might go away soon...
potential hang trigger
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1efab025-c2ca-453b-8f04-6a046ac699c8" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="trigg%rFuzz()" onblur="triggerFuzz()" onerror="triggerFuZz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="1bf8382f-9a04-4320-817e-c98224f312d4" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
Active <object> insertion
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triGgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="81b8d540-abb5-4dca-98e3-8c72682a2245" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
this script might make the browser unresponsive.
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper>i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential uaf trigger
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuz{()" onerror="trigggrFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"></coverage-gap-fill>potential uaf trigger
potential uaf trigger
potential uaf trigger
potential uaf trigger
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triegerFuzz()">console.log('recursive script at step 0');</script><script data-entangled="78288fe0-458f-4643-a6ee-8d84a116225e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential uaf trigger
this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
potential hang trigger
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="814ebda4-2ff3-4ca5-96c7-c28ae1204e59" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="4riggerFuzz()" onblur="tricgerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
hang / timeout demo<entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill></entanglement-wrapper><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="traggerFuzz()" onblur="triggerFu�z()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triGgerFuzz()" onblur="triggerFuzz()" onerror="triggerFuz{()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>this script might make the browser unresponsive.
potential uaf trigger
this script might make the browser unresponsive.
potential uaf trigger
potential uaf trigger
i might go away soon...
potential hang trigger
potential hang trigger
potential hang trigger
potential hang trigger
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="tr�ggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz)">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script><script data-entangled="7265ac58-1c77-447b-8c15-aef6e9cd970d" data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><entanglement-wrapper data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></entanglement-wrapper></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onabort="triggerfuzz()" onblur="trigoerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="e" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tragge�Fuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 2');" data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential hang trigger
potential hang trigger<!-- Appears broken in IE -->
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>Active <object> insertioni might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="%" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="tricgerFuzz()" onerror="trigge2Fuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" mouseover="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="7" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>Active <object> insertionasan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trmcgerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="trigggrGuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
i might go away soon...
i might go away soon...
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential uaf trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
new ArrayBuffer(1e6)
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="u" data-uncovered-attr="fuzz" onabort="triggerFezz()" onblur="triggerFuzx()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
document.querySelectorAll('*')
} finally {
window.lastMutation = performance.now();
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
this script might make the browser unresponsive.
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="�" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="trigwerFuzz�)"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 3');" data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
potential uaf trigger
i might go away soon...
i might go away soon...
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="s" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFujz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>potential uaf trigger
this script might make the browser unresponsive.
this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential hang trigger
this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
this script might make the browser unresponsive.
i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" mouseover="alert('Interactive mutation at step 3');" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>Active <object> insertioni might go away soon...
this script might make the browser unresponsive.
this script might make the browser unresponsive.
this script might make the browser unresponsive.
this script might make the browser unresponsive.
potential hang trigger
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzj()" onblur="triggarFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
this script might make the browser unresponsive.
i might go away soon...
i might go away soon...
hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
hang / timeout demo<coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" mouseover="alert('I�teractive mutation at step 2');" onabort="triggerFuzz()" onblur="triggezFuzz()" onerror="triggerFyzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzr()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>this script might make the browser unresponsive.
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="#" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
potential hang trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="alert('Interactive mutation at step 3');" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill click="alert('Interactive mutation at step 3');" data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" load="function handleEvent() {
try {
try {
const res = document.querySelectorAll('*');
console.debug('Mutation success:', res);
} catch(e) {
console.warn('Mutation error:', e);
document.dispatchEvent(new CustomEvent('mutationFailed'));
}
} catch(e) {
document.body.classList.add('mutation-error');
}
}" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="5"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="3" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>i might go away soon...
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerF}zz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
potential uaf trigger
i might go away soon...console.log('recursive script at step�0');
i might go away soon...
potential uaf trigger
asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggurFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>hang / timeout demo<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>asan crash demo (uaf attempt)<coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');<coverage-gap-fill data-depth="7"><script>console.log('recursive script at step 0');</script></coverage-gap-fill><coverage-gap-fill data-depth="5" data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()"><script data-uncovered-attr="fuzz" onabort="triggerFuzz()" onblur="triggerFuzz()" onerror="triggerFuzz()">console.log('recursive script at step 0');</script></coverage-gap-fill>
potential uaf trigger
i might go away soon...
<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!--[if lt IE 9]> <script>alert('old IE')<![endif]-->
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
<!--[if lt IE 9]> <script>alert('old IE')<![endif]--><!-- Google Analytics -->
asan crash demo (uaf attempt)
asan crash demo (uaf attempt)
<!-- Google Analytics --><!-- Google Analytics --><!-- Appears broken in IE --><!-- Google Analytics --><!-- Google Analytics -->i might go away soon...
asan crash demo (uaf attempt)i might go away soon...
asan crash demo (uaf attempt)asan crash demo (uaf attempt)